// how to fix
How to fix email problems
Your test or scan found a problem? Find the matching guide below: what it means, why it matters, and how to fix it step by step.
DNS 33
DMARC 28
SPF 28
DKIM 26
Reputation 24
Bounce 16
Security 16
Blacklist 13
Gmail 13
Content 12
Mailing list 11
Spam score 10
Headers 9
Reverse DNS 7
Mail server 4
Microsoft 365 4
MX 4
Outlook 4
TLS 2
Apple 1
BIMI 1
E-commerce 1
Google Workspace 1
WordPress 1
Yahoo 1
Zoho 1
28 guides · tag SPF
| Problem | In short | Tags | |
|---|---|---|---|
| No SPF record on your domain | Your domain does not say which servers may send email for it. Add one TXT record and receivers can tell your real emails from fakes. | Fix it | |
| SPF error: too many DNS lookups (permerror) | SPF allows at most 10 DNS lookups. Above that, the whole record breaks and receivers treat it as invalid. Here is how to slim it down. | Fix it | |
| Several SPF records on one domain | A domain must have only one SPF record. With two or more, SPF breaks for every email. Merge them into a single line. | Fix it | |
| SPF fails: the sending server is not authorized | Your domain has an SPF record, but the server that sent your email is not in it. Find which service sent the email and add it. | Fix it | |
| DMARC fails: SPF and DKIM do not match your domain | SPF or DKIM can pass and DMARC still fail, because they passed for another domain. Make at least one of them use the same domain as your From address. | Fix it | |
| Gmail bounce "550 5.7.26": unauthenticated email | Gmail refused your email because it could not confirm it comes from your domain. SPF, DKIM or DMARC is missing or failing. Here is how to fix it. | Fix it | |
| Emails from your website or WordPress go to spam | Contact forms, order confirmations and password resets sent by your website often land in spam. Send them through authenticated SMTP or a transactional email service. | Fix it | |
| Someone sends fake emails with your domain (spoofing) | Scammers can send emails that look like they come from your domain. A DMARC policy at reject tells receivers to refuse them. Monitor first, then enforce. | Fix it | |
| Set up SPF, DKIM and DMARC for Google Workspace | A complete checklist to authenticate a domain that sends with Gmail in Google Workspace: one SPF line, DKIM turned on in the Admin console, and a first DMARC record. | Fix it | |
| Set up SPF, DKIM and DMARC for Microsoft 365 | A complete checklist to authenticate a domain that sends with Outlook in Microsoft 365: the SPF include, the two DKIM CNAME records, and a first DMARC record. | Fix it | |
| Authenticate your domain in Mailchimp, Brevo, SendGrid and similar tools | Newsletter and transactional tools send with their own domain until you authenticate yours. Add their DKIM records and a custom return path so DMARC passes for your domain. | Fix it | |
| Email forwarding breaks SPF: how DKIM and ARC help | When someone forwards your email automatically, SPF fails because the forwarding server is not yours. A valid DKIM signature, and ARC on the forwarder, keep it trusted. | Fix it | |
| Contact form emails sent "From" the visitor's address | A website form that puts the visitor's email in the From field fails SPF and DMARC. Send from your own address and put the visitor in Reply-To instead. | Fix it | |
| SPF ends with +all or ?all (too permissive) | An SPF record ending with +all lets the whole internet send as you, and ?all protects nothing. Replace the ending with ~all or -all. | Fix it | |
| How to read DMARC aggregate reports (rua) | DMARC reports are XML files sent by Gmail, Microsoft and others. Learn what each part means and how to spot real problems and spoofing. | Fix it | |
| Email records lost after moving your domain or DNS host | You moved your domain, website or DNS to a new company and email stopped working. Often the email records were simply not copied. Here is how to restore them. | Fix it | |
| Email authentication for subdomains | Sending from news.yourdomain.com or shop.yourdomain.com? SPF and DKIM must be set for each subdomain, and DMARC can give subdomains their own policy with sp=. | Fix it | |
| Protect domains that never send email | Spare domains, old brand names and parked domains can be used by scammers to send fake emails. Three small DNS records tell the world they never send email. | Fix it | |
| Return-Path, envelope sender and From: why they must match your domain | An email has two sender addresses: the visible From and a hidden one used for bounces. For DMARC, at least SPF or DKIM must pass for the From domain. | Fix it | |
| SPF ~all or -all: which ending should you choose? | The end of your SPF record tells receivers what to do with unknown servers. Learn the difference between ~all and -all, and when to switch. | Fix it | |
| Emails to Apple "Hide My Email" addresses (privaterelay.appleid.com) | Users who sign up with Apple can hide their real address behind a relay. Your emails reach them only if you register your sending domain with Apple and authenticate it. | Fix it | |
| Outlook shows "?" or "We can't verify the sender" | Outlook replaces your photo with a question mark or says it cannot verify who sent the email. It means authentication failed; here is how to fix it. | Fix it | |
| Several email services on one domain: combine SPF and DKIM correctly | Your mailbox, newsletter tool and online shop all send as your domain. Merge them into one SPF line and give each service its own DKIM key. | Fix it | |
| SPF flattening: when it helps and what can go wrong | Flattening replaces includes with raw IP addresses to stay under 10 DNS lookups. It works, but a flattened record can silently go out of date. | Fix it | |
| Read email headers yourself: Authentication-Results, Received and DKIM-Signature | Headers are the hidden lines at the top of every email. Learn to find the three that explain why a message passed or failed. | Fix it | |
| Shopify, WooCommerce and online store emails: authenticate your domain | Order confirmations and shipping notices must reach the inbox. Make sure your store sends them with your own domain, properly signed. | Fix it | |
| Set up SPF, DKIM and DMARC for Zoho Mail | Using Zoho Mail with your own domain? Add the right SPF include for your Zoho region, turn on DKIM in the Admin Console and publish DMARC. | Fix it | |
| Set up SPF, DKIM and DMARC with OVHcloud, IONOS and other European hosts | Your email comes with your web hosting? The steps are the same everywhere: find your host's SPF value, enable DKIM if offered, then add DMARC. | Fix it |
Not sure what is wrong?
Send a test email or scan your domain: the report tells you which problem you have.